slackhq / csp-html-webpack-plugin

A plugin which, when combined with HTMLWebpackPlugin, adds CSP tags to the HTML output.
MIT License
164 stars 40 forks source link

Honor XHTML mode #62

Closed sjinks closed 4 years ago

sjinks commented 4 years ago

Summary

See #61

This PR

Requirements (place an x in each [ ])

CLAassistant commented 4 years ago

CLA assistant check
All committers have signed the CLA.

sjinks commented 4 years ago

Need to handle nonces as well…

sjinks commented 4 years ago

@AnujRNair it looks like the proper implementation will take much more effort that I have originally estimated, that's why I would like to ask you first if you are OK with this :-)

Right now, I see three options

  1. The simplest one (what is currently implemented): do not honor XHTML node if nonce generation is requested. It looks like nonce generation is on by default, although this is probably not secure: nonces should be used for a single HTTP request. That's not ideal, but this is how it works in this PR right now.
  2. The hardest one: for the XHTML mode, maintain arrays of the updated script / style tags. Then sort them by start offset in the descending order, cut off the original scripts / styles, and insert the updated tags.
  3. I have just tested it, and it seems to work (and requires less changes to the codebase), but requires an extra dependency: dom-serializer@1.0.1. The current beta of cheerio uses dom-serializer@0.1.1, but the development branch has already switched to 1.0.1. This means that this dependency can go away when cheerio reaches 1.0.0. The idea is to use this code:
    const render = require('dom-serializer').default;
    /* ... */
    // defaultProcessFn:
    const isXHTML = get(htmlPluginData, 'plugin.options.xhtml', false);
    htmlPluginData.html = isXHTML
    ? render($._root.children, { selfClosingTags: true, emptyAttrs: true })
    : $.html(); 

Once cheerio reaches 1.0.0, this will be simplified to:

const isXHTML = get(htmlPluginData, 'plugin.options.xhtml', false);
const options = isXHTML ? { selfClosingTags: true, emptyAttrs: true } : {};
htmlPluginData.html = $().html(options);

What do you think?

sjinks commented 4 years ago

Closing, as it looks like there is no interest in this PR.